MB Connect Line mbCONNECT24 and mymbCONNECT24 SQL Injection Vulnerability

A SQL injection vulnerability has been identified in MB Connect Line's mbCONNECT24 and mymbCONNECT24 applications, specifically in versions 2.20.0 and prior. This vulnerability allows low-privileged remote attackers to exploit unauthenticated SQL injection in the tag view, leading to a complete loss of confidentiality by improperly neutralizing special elements in a SQL SELECT command.

Impact

Exploitation of this vulnerability allows for SQL injection, with varying degrees of database access depending on the specific vulnerability exploited.

Remediation

Users are advised to update their mbCONNECT24 or mymbCONNECT24 instance to version 2.20.1.